27 matches found
EUVD-2026-39239
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tbxdppropertiesrequest derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A maliciou...
CVE-2026-53148
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tbxdppropertiesrequest derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A maliciou...
CVE-2026-53148
In the Linux kernel Thunderbolt code, tb_xdp_properties_request derives per-packet copy length from the response header and may exceed the previously allocated data buffer, allowing memcpy to write past the kcalloc allocation. The fix clamps the per-packet copy length so that the cumulative offse...
CVE-2026-53147
CVE-2026-53147 (Linux kernel Thunderbolt XDomain) : The issue arises in tb_xdp_handle_request() which casts a received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer can send an XDomain packet that passes the generic he...
CVE-2026-53147
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tbxdphandlerequest casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer...
CVE-2026-53146
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Limit XDomain response copy to actual frame size tbxdomaincopy copies req-responsesize bytes from the received packet buffer regardless of the actual frame size. When a short response arrives, this reads past the val...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: Thunderbolt: Mark the XDomain as unplugged when the router is removed. I noticed that when we perform discrete host-router NVM upgrades, and the router is hot-unplugged due to NVM firmware authentication issues, if there are othe...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: fixed a memory leak in tbnetopen. When tbringallocrx fails in tbnetopen, the memory allocated in tbxdomainallocouthopid is not released. Add tbxdomainreleaseouthopid to the error path to release the allocated...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993104)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993104 advisory. In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Mark XDomain as unplugged when router is removed I noticed that when we do discrete...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990835)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990835 advisory. In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Mark XDomain as unplugged when router is removed I noticed that when we do discrete...
OESA-2024-2426 kernel security update
The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: pinctrl: single: fix potential NULL dereference in pcsgetfunction pinmuxgenericgetfunction can return NULL and the pointer 'function' was dereferenced without...
OESA-2024-2425 kernel security update
The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: pinctrl: single: fix potential NULL dereference in pcsgetfunction pinmuxgenericgetfunction can return NULL and the pointer 'function' was dereferenced without...
OESA-2024-2424 kernel security update
The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: pinctrl: single: fix potential NULL dereference in pcsgetfunction pinmuxgenericgetfunction can return NULL and the pointer 'function' was dereferenced without...
UBUNTU-CVE-2022-48955
In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: fix memory leak in tbnetopen When tbringallocrx failed in tbnetopen, ida that allocated in tbxdomainallocouthopid is not released. Add tbxdomainreleaseouthopid to the error path to release ida...
SUSE CVE-2024-46702
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Mark XDomain as unplugged when router is removed I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware authentication, if there is another...
CVE-2024-46702
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Mark XDomain as unplugged when router is removed I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware authentication, if there is another...
CVE-2024-46702
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Mark XDomain as unplugged when router is removed I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware authentication, if there is another...
DEBIAN-CVE-2024-46702
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Mark XDomain as unplugged when router is removed I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware authentication, if there is another...
AZL-49332 CVE-2024-46702 affecting package kernel for versions less than 5.15.167.1-1
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Mark XDomain as unplugged when router is removed I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware authentication, if there is another...
UBUNTU-CVE-2024-46702
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Mark XDomain as unplugged when router is removed I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware authentication, if there is another...